ASD Defending Against AI-Enabled Cyber Attacks Guide

AI has shortened the time between a vulnerability existing in an internet-facing system and an attacker exploiting it, and the Australian Signals Directorate now tells boards to change their risk tolerance accordingly. On 6 July 2026 ASD's Australian Cyber Security Centre (ASD's ACSC) published "Defending against AI-enabled cyber attacks" as three documents: one for government, critical infrastructure and large enterprises, one for medium-sized businesses and one for small businesses. The guidance is not a law or a mandatory standard, but it sets the expectation Australian regulators, auditors and boards will measure against. This guide sets out what ASD actually recommends at each tier and time horizon, how it fits with the Essential Eight and the ISM, and how to turn it into a programme with owners, tests and metrics. It is written for CISOs, vulnerability management leads and IT managers, inside and outside Australia.

Source note: recommendations come from the three cyber.gov.au guidance pages, checked on 11 November 2026, and are paraphrased. PDF versions exist for each tier; the web pages were used here. Mapping to other frameworks is NHI Mgmt Group analysis. Confirm against the official text before relying on it.

Key takeaways

The threat is speed, not new techniques. ASD's position is that AI accelerates vulnerability discovery and exploitation, lets attackers hit many targets at once and chain low-severity flaws into high impact, rather than inventing new tactics.
Internet-facing services come first. Every tier of the guidance starts with finding, removing, replacing and rapidly patching internet-facing services, including vulnerabilities of all severities, not just critical ones.
Boards must accept more outage risk. The large enterprise guidance asks boards to tolerate brief outages from faster patching and lower their tolerance for unsupported internet-facing systems.
Identity is in scope. Least-privilege accounts for internet-facing services, rehearsed mass password resets and restricted privileges for AI agents all appear in ASD's 2026 AI guidance.
Defensive AI is endorsed, carefully. ASD recommends supervised, controlled use of AI to find vulnerabilities in code, analyse logs and support penetration testing.

What ASD published and why

The guidance follows a run of ASD publications on frontier AI. On 9 April 2026 ASD published its first assessment of frontier models and cyber security, updated on 30 April after Anthropic announced Claude Mythos Preview. That update recorded that Mozilla attributed 271 vulnerabilities fixed in one Firefox release to the model, and that the UK AI Security Institute saw it complete a 32-step simulated network attack on some runs, in test environments with no active defenders, EDR or alerting. ASD's conclusion was that AI changes the scale and speed of finding and exploiting existing defect classes, and that similar techniques were being reproduced with cheaper open-weight models.

Date	ASD publication	Audience
9 April 2026 (updated 30 April)	Frontier models and their impact on cyber security	All organisations
6 July 2026	Defending against AI-enabled cyber attacks (three tiers)	Government, critical infrastructure and large enterprises; medium-sized businesses; small businesses
24 July 2026	Careful adoption of agentic AI in cyber defence (points to Five Eyes guidance)	Security teams using AI agents
5 August 2026	Frontier AI: cyber threat considerations for boards of directors (with the AICD)	Boards and senior leaders

The threat model in the July guidance is specific: attackers may use AI to find vulnerabilities and build exploits within hours, target many victims at once through internet-facing services such as websites, chain lower-severity vulnerabilities into high-severity impact, and move quickly from initial compromise to data theft, extortion or disruption. In ATT&CK terms that is T1595.002 Vulnerability Scanning and T1190 Exploit Public-Facing Application, with T1588.007 (Obtain Capabilities: Artificial Intelligence) describing the adversary's AI tooling. The guidance does not address AI-generated phishing or deepfakes; for those, see the AI-Generated Phishing Defence Guide.

The recommendations by tier and time horizon

The large enterprise document uses four horizons (immediate, short, medium, long term); the medium-sized business document uses three; the small business document is a single list plus questions to ask whoever maintains your website.

Horizon	Government, critical infrastructure and large enterprises	Medium-sized businesses	Small businesses
Immediate	Name an accountable executive for AI risk (attackers' AI and your own); board accepts outage risk from faster patching; patch or mitigate all severities on internet-facing services, automating where rollback is easy; identify internet-facing services daily, remove or replace unsupported ones; resource the work	Brief the CEO, IT and service providers; inventory and prune internet-facing services; replace unsupported ones; patch quickly with automation; turn on automatic updates for browsers and operating systems	Share the guidance; switch off unneeded websites and features; turn on automatic updates for computers, tablets and phones; review who stores your customer data; scan software you build; name a person or provider responsible for website security
Short term	Least-privilege accounts for internet-facing services; segment them from each other and the corporate network; enforced secure configuration baselines; verify controls actually work; centralise and promptly analyse logs with pre-approved, narrow, reversible automated responses; exercise IR and restore from protected backups; test rapid network blocking and mass password resets	Rehearse IR including restore from protected backups; rehearse continuity including network blocking and resetting all passwords; block unneeded traffic; least-privilege service accounts; review logs promptly	Not separated by horizon
Medium term	Prefer SaaS where the provider owns rapid remediation; choose suppliers with security transparency and separate security patches from feature updates; supervised AI for code review, log analysis and testing; extend controls to other devices by risk	Prefer reputable SaaS; choose secure-by-design vendors; careful, supervised AI for vulnerability discovery, log analysis and testing; extend controls to other devices	Not separated by horizon
Long term	Modern, defensible, layered architecture traced to business, security and resilience objectives, using zero trust and Secure by Design	Not included	Not included

Three points stand out against older ASD advice. First, the instruction to patch vulnerabilities of all severities on internet-facing services reflects the chaining threat: a medium-severity flaw is no longer safe to defer. Second, the guidance asks for daily identification of internet-facing services, which is an attack surface management requirement, not an annual asset review. See the Attack Surface Management Guide. Third, automated response is endorsed only when it is pre-approved, narrowly scoped and reversible, which is a useful design rule for SOAR playbooks.

How it fits with the Essential Eight and the ISM

The July guidance does not cite Essential Eight strategies or ISM control identifiers, but it sits on top of them. The Essential Eight already sets patch timeframes for internet-facing services from Maturity Level One (within 48 hours when a working exploit exists). ASD's 2026 position is that AI makes that 48 hour window the norm rather than the exception, and extends urgency to lower-severity findings. See the Essential Eight Guide and the Australian ISM Guide.

ASD AI guidance action	Closest Essential Eight strategy	NIST SP 800-53 Rev 5	NIST CSF 2.0
Accountable executive, board risk tolerance	Not covered	Not mapped	GV.RR-01
Daily inventory of internet-facing services	Not covered	CM-8	ID.AM-02
Rapid patching of all severities	Patch applications; patch operating systems	SI-2, RA-5	ID.RA-01, PR.PS-02
Remove or replace unsupported services	Patch applications; patch operating systems (unsupported software removal)	SI-2	PR.PS-02
Least-privilege service accounts	Restrict administrative privileges	AC-6	PR.AA-05
Segmentation of internet-facing services	Not covered	SC-7	PR.IR-01
Secure configuration baselines	User application hardening	CM-2, CM-7	PR.PS-01
Centralised, prompt log analysis	Not covered	AU-2, SI-4	DE.CM-01, DE.CM-09
Protected backups and rehearsed recovery	Regular backups	CP-9, IR-4	RS.MI-01
Mass password resets rehearsed	Multi-factor authentication (supporting)	IA-5, IR-4	RS.MI-01

ISO/IEC 27001:2022 users will find the same ground in Annex A 8.8 (management of technical vulnerabilities), 8.9 (configuration management), 8.15 (logging), 8.16 (monitoring), 8.20 to 8.22 (network security and segregation) and 8.13 (information backup).

Where identity fits

The guidance is framed around patching, but several of its actions are identity controls. Accounts used by internet-facing services must have minimum access, because an exploited web application inherits the privileges of the account it runs as; a service account with domain or cloud admin rights turns a web bug into a full compromise. The continuity requirement to test mass password resets assumes you know which credentials exist, including service accounts, API keys and tokens that a user password reset does not touch. ASD's board guidance of 5 August 2026 goes further and asks organisations to strengthen identity and access management and restrict privileges, including for AI agents. See the Agentic AI Identity Guide.

Inventory the non-human identities behind internet-facing services: application pool identities, managed identities, database logins, CI/CD deploy keys.
Remove standing admin rights: internet-facing services should never run as local or domain administrators.
Plan the credential reset: a mass reset that only covers human passwords leaves attackers holding valid tokens and keys. Include secret rotation in the runbook.
Constrain defensive AI agents: if you adopt AI for log analysis or testing, give it least privilege, human approval for high-impact actions, full logging and the ability to halt it, as ASD's 24 July note on agentic AI in cyber defence sets out.

Turning the guidance into a programme

NHI Mgmt Group recommendation: this section and the decision guidance below are our own guidance, not requirements of the source document.

Appoint the accountable executive and brief the board. Present the risk tolerance changes ASD asks for (accepting outage risk from faster patching, near-zero tolerance for unsupported internet-facing services) as explicit decisions to minute.
Build the internet-facing inventory. Combine external attack surface scanning, DNS and certificate transparency data, cloud asset inventories and firewall rules. Reconcile daily and assign an owner to every service. Remove anything without an owner after a short notice period.
Change patch policy. Set target timeframes for internet-facing services that cover all severities. Automate where rollback is easy (stateless web tiers, containers redeployed from images); keep a manual gate where a bad patch is costly. See the Patch Management Guide.
Pilot before you automate. Run automated patching on a canary ring of internet-facing services first, measure failed patches and rollback time for two to four cycles, then widen. Keep the previous image or package available for immediate rollback.
Harden and segment. Apply configuration baselines, remove weak protocols, and segment internet-facing services from each other and from corporate networks. Verify with configuration scans and segmentation tests, as ASD asks, rather than trusting the design.
Centralise logs and pre-approve responses. Define a short list of automated responses (block an IP, disable an account, isolate a host) that are narrow and reversible, approve them in advance, and test them.
Exercise recovery. Run a tabletop and a technical exercise covering restore from protected backups, rapid network blocking and mass credential resets, with timings recorded.
Adopt defensive AI in a sandbox. Start with AI-assisted code review on pre-release code and log triage, with human review of every finding and no production write access.

Decision guidance

Patch now or mitigate: patch where a tested update exists and rollback is easy; mitigate (WAF rule, disable feature, restrict access) where the patch is untested or the service is fragile, and track the mitigation to removal.
Keep or replace a legacy internet-facing system: if it is unsupported, ASD's direction is to remove or replace it urgently and add monitoring and compensating controls in the meantime. Do not accept indefinite exceptions.
Self-host or SaaS: SaaS shifts remediation speed to the provider, which ASD favours for medium and large organisations. It also shifts identity risk to OAuth grants and API tokens, so pair it with SaaS integration governance.
Small business: focus on the six actions and four questions for your website maintainer; automatic updates and removing unused sites deliver most of the benefit.
Critical infrastructure: combine this guidance with your SOCI Act obligations and OT change windows. See the Australia SOCI Act Guide.

Detection and measurement

Monitor internet-facing services for exploitation attempts against newly disclosed vulnerabilities, unexpected process execution by web service accounts, new outbound connections from internet-facing hosts, authentication by service accounts from unusual sources, and sudden changes in the external attack surface (new hosts, ports or certificates).

Internet-facing inventory freshness: hours since the last full reconciliation (target under 24).
Time to remediate on internet-facing services: median and 90th percentile, all severities, not just critical.
Unsupported internet-facing services: count, trending to zero, with dated replacement plans.
Service accounts with excess privilege: count of internet-facing service identities with admin rights.
Recovery drill timings: time to block network paths, reset all credentials and restore a priority system.
Failed patch rate: to show the board the outage risk it accepted is under control.

Common failure patterns

Patching by CVSS only. Deferring medium findings ignores ASD's chaining warning. The Exploited Vulnerability Breaches guide shows how often public-facing flaws are the entry point.
An inventory that misses shadow services. Marketing sites, old test environments and forgotten APIs are what AI-assisted scanning finds first.
Keys exposed in public-facing code. The Football Australia AWS Keys Exposure 2024 shows cloud keys in website code opening storage buckets; automated discovery finds these faster than ever.
Mass reset that forgets non-human credentials. Resetting user passwords while API keys and tokens remain valid leaves the attacker in place.
Automated response that cannot be undone. Broad, irreversible playbooks cause outages and get switched off; ASD asks for narrow, reversible, pre-approved actions.
Unsupervised AI agents in defence. Giving an AI agent production write access for "faster remediation" creates a new privileged identity without oversight.

Practitioner checklist

Name the executive accountable for AI-related cyber risk and minute the board's risk tolerance decisions.
Reconcile the internet-facing service inventory daily and give every service an owner.
Set remediation targets for all severities on internet-facing services and automate where rollback is easy.
Remove or replace unsupported internet-facing services, with compensating controls until then.
Run every internet-facing service under a least-privilege identity and segment it.
Centralise logs and approve a short list of narrow, reversible automated responses.
Exercise restore, network blocking and mass credential reset, including non-human credentials.
Pilot supervised defensive AI for code review and log analysis with no production write access.

ASD Defending Against AI-Enabled Cyber Attacks Guidance Guide